How to Use lsof Command

lsof is a command meaning “list open files”, which is used to report a list of all open files and the processes that opened them.

It is used to show that which file is open by which process. In this article, you will learn that how to use lsof command.

Some useful command are as below:

If “lsof” is not working on your system, simple run below command in order to install it.

yum install -y lsof

1- List all open files

run following command to list all open files.

lsof

Command: The name of the command associated with the process that opened the file.
PID:           Process ID of the process that opened the file.
TID:           Task or thread Identification number. if its blank it means, it is not a task. it is a process.
User:          User ID or the owner name of the process.
FD:            Shows the file descriptor of the file.
Type:         type of node associated with the file.
Device:      Contains device numbers.
Size/Off:   Shows the size of the file in bytes.
Node:        Shows the node number of a local file.
Name:       Shows the name of the mount point and file system on which the file placed.

Show Files Opened By a User

So, below command will show the list of all opened files of user “osradar”

lsof -u osradar

Print all Network Connections

lsof -i

See files based on IPv4 Address

lsof -i 4

list files based on IPv6 Address

lsof -i 6

List Processes of TCP Specific Port

To show all running process of a specific port, use -i option with lsof command. In below command we will show running process of port 22

lsof -i TCP:22

List Processes of TCP Ports range

Below command will show you all the files processes from port 1 to port 1024

lsof -i TCP:1-1024

See who is Looking What Files and Commands

lsof -i -u osradar

List files by PID

below command will show you who is running on process 1326

lsof -p 1326

I hope you will learn much about lsof command, if you want to go deeper see man pages by running command “man lsof“